98fecf58d3747c45fb3e9e0166fb2602b57a4e0cb7fdc946d781096fcfd7e1b7

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-e6v9vasvd1
SHA256 98fecf58d3747c45fb3e9e0166fb2602b57a4e0cb7fdc946d781096fcfd7e1b7
MD5 0114aaed31887da93c4937d74c2b67fd
SHA1 605bd3fd59cfad228fc29948275b2389ef9ae653
SHA512 1b0413b7fa6721ad9315ea7f1abc2e5242ef92fb3582c44a8b5345ade360c0c84f6441b9a4afb408b4feffe4d2556c48898ed17c1bf5fa584cf54701ea8dec0e
SSDEEP 49152:JyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb0:3UjFqquuu6f9Aau1lZIUH0PgExyDbb0
TLSH
T11DD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 442355f643ac540094bf74c026a83d31626ca19aa7c584396b7adcba56e874f0
- MD5 96068d59b7e894468ca0ee11a4c3ee24
- SHA1 afb8e35a45d22196ff9073358f61c5bea38ac0c0
- SHA512 fabe2134ac13637f8e2cc9c100e5566837ed026564b00fc376122f85305040483d34d83287c6f465a2dd6fa3d9646fd67404527e0ad01bceb8ab8bc35d2e73cf
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYo:DC/p+HuPOc4V
- TLSH
  T17F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2